Cisco Vulnerability Added to CISA KEV Under Active Exploitation
Key findings • Cisco vulnerability CVE-2026-76460 added to CISA KEV on September 16, 2026. • The flaw is confirmed to be under active exploitation by malicious actors. • Immediate patchin…
Key findings
- Cisco vulnerability CVE-2026-76460 added to CISA KEV on September 16, 2026.
- The flaw is confirmed to be under active exploitation by malicious actors.
- Immediate patching and mitigation are critical for all affected Cisco systems.
- Organizations should consult Cisco's advisories for specific remediation steps.
CISA has added CVE-2026-76460, a vulnerability affecting Cisco Systems, Inc. products, to its Known Exploited Vulnerabilities (KEV) catalog. This inclusion signifies that the flaw is under active exploitation by malicious actors, posing an immediate threat to organizations utilizing affected Cisco systems. The KEV catalog serves as a critical resource for federal agencies and is increasingly adopted by private sector entities to prioritize remediation efforts against the most dangerous vulnerabilities.
The vulnerability, identified as CVE-2026-76460, represents a significant security risk. While specific technical details of the exploit are not yet fully public, its presence in the KEV catalog underscores its severity and the urgency for immediate action. Organizations are advised to consult Cisco's official security advisories for comprehensive information regarding the affected products and recommended mitigation strategies.
Active exploitation means that attackers are already leveraging this flaw to compromise systems, potentially leading to unauthorized access, data breaches, or service disruptions. The addition to the KEV catalog on September 16, 2026, triggers mandatory remediation timelines for federal civilian executive branch (FCEB) agencies, who must address the vulnerability by the specified due date. This urgency should extend to all organizations, regardless of sector, to protect their digital assets.
Defenders must prioritize patching and mitigation for CVE-2026-76460 immediately. Organizations should identify all Cisco products within their infrastructure that may be affected by this vulnerability. Following vendor guidance, applying available security updates, and implementing any recommended workarounds are crucial steps. Proactive threat hunting for signs of compromise related to this CVE is also advised.
Cisco has issued an emergency patch for CVE-2026-76460, a critical authentication bypass vulnerability in its Identity Services Engine (ISE) software. The flaw, which affects both Cisco ISE and ISE Passive Identity Connector (ISE-PIC), allows unauthenticated remote attackers to bypass authentication and gain access to devices. Cisco has confirmed active exploitation in the wild and warns that successful exploitation could allow attackers to execute commands with root privileges, potentially hiding or deleting indicators of compromise.
The new article from Infosecurity Magazine provides additional technical details on the exploitation of Cisco Identity Services Engine (ISE) flaw CVE-2026-76460. It elaborates on the mechanism of exploitation, which involves sending a crafted request to an API endpoint to bypass the web-based management interface and gain unauthorized access. Furthermore, it highlights the severity of successful exploitation, which can lead to command execution with root privileges, enabling attackers to cover their tracks.
The new article provides further technical details on the exploitation of CVE-2026-76460, including how attackers can bypass authentication via a specially crafted API request to gain root privileges. It also outlines Cisco's recommended mitigation strategies, such as implementing infrastructure access control lists (iACLs) as a temporary measure and thoroughly investigating systems for signs of compromise by reviewing log files for suspicious activity.
This new report details that the critical CVE-2026-76460 vulnerability in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) has received a perfect CVSS score of 10.0. It also highlights that successful exploitation allows unauthenticated remote attackers to achieve command execution with root privileges, and Cisco is aware of active exploitation. The article further notes that no workaround exists, and while infrastructure access control lists can offer temporary mitigation, permanent fixes are available in specific patch versions.
The vulnerability, identified as CVE-2026-76460, carries a critical CVSS score of 10.0 and affects Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Exploitation allows unauthenticated remote attackers to bypass authentication via a crafted API request, potentially leading to unauthorized access and even root-level command execution. Cisco has released patches for multiple versions of ISE, including 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4, and strongly advises immediate upgrades. While no workarounds exist, infrastructure access control lists (iACLs) can be used as a mitigation to restrict management traffic.
Cisco has disclosed a second actively exploited zero-day vulnerability, CVE-2026-76460, affecting its Identity Services Engine (ISE) API. This critical flaw allows remote attackers to bypass authentication and gain full control of affected devices, enabling policy modification, credential theft, and lateral movement. The vulnerability was discovered during a technical support case and has also been added to CISA's Known Exploited Vulnerabilities catalog, with Cisco urging immediate upgrades to patched software.
This new report from Dark Reading details CVE-2026-76460, a critical authentication bypass vulnerability affecting Cisco's Identity Services Engine (ISE). The flaw received a maximum CVSS score of 10, underscoring its severe security implications and the potential for attackers to gain unauthorized access to sensitive systems.